Journal mailboxes are growing

Hi all,

I have three journaling tasks on three servers in two forests, all of which have built up a bit of a backlog in the last week or two.

I am not sure what information to give, so here's an overview of the setup, and some performance details.

Journaling task 1 - Forest 1 - Exchange 2007

The task is set to 5 concurrent connections and 10000 messages per pass. It appears to have been ingesting on average 60000 messages per day, but the journal mailbox is currently backlogged with 72000 items of the following message classes: 40000 Message, 10000 EnterpriseVault PendingArchive Part, 22000 Enterprise Vault PendingArchive. No errors are logged in the event log for this task, but monitoring is showing a 41289: It is more than 1 days since the journal mailbox 'Exchange 2007. Journal' was scanned for items to archive.

Journaling Task 2 - Forest 2 - Exchange 2007

The task is set to 5 concurrent connections and 10000 messages per pass. The mailbox is backlogged at 100000 items, with 6500 Message, 60000 PendingArchive Part, and 35000 PendingArchive. No errors are logged for this task.

Journaling Task 3 - Forest 2 - Exchange 2010

The task is set to 5 concurrent connections and 10000 messages per pass. The journal mailbox is sitting at 55000 items, with 38000 Message, 11000 PendingArchive Part, and 6000 PendingArchive. No errors are logged for this task, but it is showing the same 41289 in the monitoring as Task 1.

Both of these tasks are archived into the same VaultStore, and have processed about 20-30k items each day for the last week.

Outside of the journaling, we are running mail archiving on three Exchange farms (5000 mailboxes, a lot of which are dormant though) and File Archiving on one fileserver. The File Archiving is confined to after hours, the mail archiving has been running 24/7 for a while to deal with a large amount of newly added mailboxes, but has been scaled back to after hours recently. Only the journaling is running 24/7.

The server is a fairly beefy 16CPU/24GB RAM box with EV 10.0.3 and hotfix rollup 2. The daily item count appears to be on par with historical performance, so I am mainly concerned about the item buildup in the mailboxes. Since we are keeping the journal vault for compliance reasons, it may become a problem when these items cannot be found in the journal archive, or are only available after delays. 

If anyone has got some tips on how to deal with the backlogs, I'd be most appreciative.

1 Solution

Accepted Solutions
Accepted Solution!

Can you synchronize the

Can you synchronize the journal mailboxes ok? Maybe issues with the system mailbox that they're using Also check that MSMQ has not gone over its 1gb default quota Other than that, check usual things like that the mailbox itself isn't quota'd and that you're not in read only mode, that the journal task isn't in report mode Also make sure your Anti virus exclusions are set and there's no bottle neck on the storage etc
https://www.linkedin.com/in/alex-allen-turl-07370146

View solution in original post

5 Replies
Accepted Solution!

Can you synchronize the

Can you synchronize the journal mailboxes ok? Maybe issues with the system mailbox that they're using Also check that MSMQ has not gone over its 1gb default quota Other than that, check usual things like that the mailbox itself isn't quota'd and that you're not in read only mode, that the journal task isn't in report mode Also make sure your Anti virus exclusions are set and there's no bottle neck on the storage etc
https://www.linkedin.com/in/alex-allen-turl-07370146

View solution in original post

if all that checks out, i've

if all that checks out, i've seen poorly maintained sql databases cause this type if behavior as well and it's just as you describe where everything is fine for the longest time and then out of the blue it gets like this

I am not 100% sure about the

I am not 100% sure about the synchronization - I do see the message that a sync run has started on the affected journal mailboxes.

MSMQ quota is set to 8GB on our server, it's far below that. MSMQ folders are on a different drive from C: and are exempted from virus scans.

The journal mailboxes have no set quota. Read-Only and Report mode are all checking out. The tasks *are* processing, I am just getting the unusual backlog.

 

Might have to look at that.

Might have to look at that. Wouldn't be surprised if the DBs were a bit dodgy.

Highlighted

It does appear that there was

It does appear that there was an issue with the MSMQ quota and the journal quota being different. After rectifying that, the J2 queues have filled up for all journal tasks. Still got a backlog, but at least it seems to be processed faster.